2018-02-21 EMOTET IOCs

**note - incomplete list**

DOC DISTRIBUTION:
hxxp://ekavi-apartments[.]com/Invoice/
hxxp://ftcaffiliated[.]com/Past-Due-Invoices/

DOC DELIVERED:
d5c295ed10fa7962ad4cbce3e9880c93
aa4de0f62eef07ec36357250845a7eff5d66e1b36b03a380ea1113dab3ce7117

PAYLOAD DISTRIBUTION:
hxxp://aldrizzagno[.]com/qljZh/
hxxp://make-clean[.]ru/pyxuY/
hxxp://personaltrainercamaswashington[.]com/2pyOE0E/
hxxp://soohagallery[.]com/Zhmyq1v/
hxxp://www.maxpersico[.]com/eG8O/

PAYLOADS OBSERVED:
a10915a73e5c5967daa4dc0a6ca1a00c
1c39152370cbc674442ae0cdefd1e15c4c779a9d3d66edd586060c0e824939e6

2401bbf615e54656d8156c1461e8761b
792fbdf829c32e350b0ba78916f1c2bae7420ccaa638f1d520c671d8260669a9

873db0c22fb0cd9c6ffa204d12092843
fca55f547e276543e96a8ecc4cac83b7f6b2e0ace58287f7240b3561f1e4471b

C2:
hxxp://159.203.94[.]198:4143/
hxxp://178.62.253[.]139:4143/
hxxp://54.227.38[.]29/
hxxp://80.82.115[.]164:4143/